v1.1.0

Highlights

Fusion 1.1.0 makes an installed copy traceable and puts the enforcement suite
on firmer ground. It also corrects a claim about the bash allowlist that had
been wrong in five places.

Added

• The skill bundle has a version. install.js records bundleVersion in
  .fusion-install.json, prints it in the apply plan, and /fusion-status
  reports it, so an installed copy traces back to the release that applied it.
  It records the most recent apply, so a reapply that selects a subset of roles
  leaves the other managed files as an earlier bundle installed them.
• The bash allowlist's Node assumption is documented. The five shipped
  verification commands only exist in a Node toolchain, so on any other stack
  the main agent got denied on the command it should have been running. README
  now names the per-stack tools (Python, Rust, Go, Make), explains why an exact
  pattern beats a trailing *, and records which entries each role ships. No
  entries were added to the bundled prompts.
• An advisory CI lane runs the live enforcement tests against the opencode
  2.0 beta. FUSION_OPENCODE_BIN picks the binary; the existing v1 lanes are
  unchanged. The suite resolves the two tools v2 renamed (bash -> shell,
  task -> subagent) so one set of assertions covers both.
• The suite refuses to pass vacuously. Every "denied tool is absent"
  assertion now also requires that an unrestricted agent is offered that tool,
  so an absence caused by a release dropping the tool is reported as
  inconclusive instead of green.
• The docs site has a changelog page. site/changelog.html is generated
  from CHANGELOG.md and committed; npm test fails when it has drifted.

Changed

• Refreshed profile model picks. opencode-go leads with Kimi K3 and
  reviews with Grok 4.5; opencode-zen sidekicks with GPT-5.6 Luna;
  github-copilot moves sidekick and explore from GPT-5.4 Mini to GPT-5.6 Luna;
  chatgpt gains a GPT-5.6 Terra reviewer. Only new installs and reapplies pick
  these up - an existing opencode.json keeps the models it was installed with
  until you reconfigure.
• Agent routing is explicit. Each role in build.md gets a
  Delegate when / Don't delegate when pair, and research.md and
  reviewer.md gained a STATUS / FINDINGS / VERIFIED / GAPS report format.
  Prompt wording only; the mechanical guarantees still come from permission
  frontmatter.
• Corrected what command chaining actually does, in build.md, plan.md,
  reviewer.md, README, and site/docs.html. All five said a chained line
  matches no pattern and is blocked outright. Probed against opencode 1.18.7,
  the permission layer matches each command in the line separately and denies
  only if one fails. The advice to run one command per call is unchanged; the
  stated reason was wrong. A contract test pins the disproven wording out of
  all five surfaces.
• A denied command is a boundary, not a puzzle. plan.md and reviewer.md
  now say to find an allowed command that answers the same question instead of
  hunting for a variant that slips through. Only build.md said this before.
• The harness config sets subagent_depth: 2, matching every real install.
• plan.md carries the allowlist guidance build.md already had.
• vision.md's clipboard instructions no longer assume Windows.
• The Limitations section states what opencode 2.0 does and does not carry over.

Fixed

• The theme toggle's moon rendered as a lopsided blob rather than a crescent:
  its inner arc asked for a radius too small to span its endpoints, so SVG
  scaled it up and the crescent lost its taper. Fixed on all three pages.
• The mobile nav collapses below 940px instead of 900px, removing a horizontal
  scroll the new Changelog link introduced between those widths.

Compatibility

Manifests written before 1.1.0 have no bundleVersion. They are still valid
manifest schema 2, and undo continues to accept them.

Install

npx skills add mihneaptu/opencode-fusion --skill fusion-setup -g -a opencode -y

Requires Node 20.12 or newer. Fully quit and restart opencode after installing.